The way companies everywhere work is powered by SaaS. From collaboration tools to critical infrastructure, organizations rely on SaaS applications to drive their business forward. But this widespread adoption has created a significant security blind spot. How can you ensure every one of these applications is configured securely when they all offer different settings, capabilities, and levels of visibility?
This inconsistency creates friction, wastes resources, and ultimately, exposes businesses to unnecessary risk.
At MongoDB, we believe that securing the SaaS ecosystem is a shared responsibility. That's why we were proud to collaborate with the Cloud Security Alliance (CSA) and industry leaders like GuidePoint Security to develop a new standard—the SaaS Security Capability Framework (SSCF).
The problem: A gap in cloud security
For years, the majority of security assessments have focused on the SaaS provider's organizational security, often through frameworks like SOC 2 or ISO 27001. While essential, these frameworks don't always address a critical question: what security capabilities are available to the SaaS customer within the application?
This gap means that security teams face a chaotic landscape. Every new SaaS app brings a different set of configurable controls for logging, identity management, and data access. This makes it nearly impossible to implement and track consistent security policies at scale, leading to a burdensome assessment process for everyone involved.
The solution: A common framework for SaaS security
The SSCF was created to solve this problem by establishing a clear, technical set of customer-facing security controls that SaaS vendors should provide. The framework is designed to empower customers by ensuring they have the tools they need to operate applications securely at scale on their side of the Shared Security Responsibility Model (SSRM).
The framework helps with many use cases, but three key audiences stand out:
For risk management teams: The SSCF provides a clear baseline to use during vendor assessments, simplifying procurement.
For SaaS security teams: It offers a checklist for implementing the security features enterprises expect, streamlining the security program.
For SaaS vendors: The SSCF standardizes assessment responses, reducing the overhead of custom questionnaires and helping vendors meet customer requirements.
The SSCF focuses on six critical domains, aligned with CSA’s Cloud Control Matrix, providing specific and actionable controls for each:
Change Control and Configuration Management (CCC): Ensuring you can programmatically query and get documentation on all security configurations.
Data Security and Privacy Lifecycle Management (DSP): Giving customers control over features like disabling file uploads to prevent malicious code.
Identity and Access Management (IAM): Providing robust, modern controls for user access, including SSO enforcement, non-human identity (NHI) governance, and a dedicated read-only security auditor role.
Interoperability and Portability (IPY): Giving administrators control over mass data exports and visibility into application integrations.
Logging and Monitoring (LOG): Defining a clear set of comprehensive requirements for machine-readable logs with mandatory fields for effective threat detection and forensics.
Security Incident Management (SEF): Requiring a simple, effective way for vendors to notify a designated customer security contact during an incident.
MongoDB's commitment to a more secure ecosystem
Our involvement in creating the SSCF stems from our deep commitment to the security of our customers' data and the broader developer community. We believe that robust security shouldn't be an afterthought; it must be built in and easy to consume. The principles outlined in the SSCF—like strong identity controls and comprehensive logging—are philosophies we already built into our own data platform.
Strong security capabilities allow our customers to build and innovate faster and more securely, knowing they have a reliable foundation. And personally, as a co-chair of the CSA SSCF, I’ve seen great excitement and engagement on the part of our working group—which helped me realize how many companies are affected by this lack of consistency.
The SSCF is a vital step toward creating a more trusted, efficient, and secure global SaaS ecosystem. We are thrilled to have been a part of this foundational work and will continue to champion this standard that empowers developers and security teams alike.
Visit our security page to learn more about how MongoDB helps protect your data.